Vulnerability-Lookup

CVE-2026-56393 (GCVE-0-2026-56393)

Vulnerability from cvelistv5 – Published: 2026-06-21 13:27 – Updated: 2026-06-22 13:22

Title

Craft CMS - Multiple Stored Cross-Site Scripting in Settings Names and Field Options

Summary

Craft CMS 4.x (>= 4.0.0-RC1, < 4.17.0-beta.1) and 5.x (>= 5.0.0-RC1, < 5.9.0-beta.1) contain multiple stored cross-site scripting vulnerabilities where settings names and field option labels are rendered without sanitization (e.g., via the checkbox.twig template, which used {{ label|raw }}). An authenticated administrator (with allowAdminChanges enabled) can inject malicious payloads into section names, volume names, user group names, global set names, generated field names, checkbox/radio option labels, and custom source labels, causing arbitrary JavaScript to execute in other users' control-panel sessions. Fixed in 4.17.0-beta.1 and 5.9.0-beta.1.

Severity

4.6 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

4.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-22 13:21 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

VulnCheck mitre root

References

4 references

URL	Tags
https://github.com/craftcms/cms/security/advisori…	vendor-advisory
https://github.com/craftcms/cms/commit/943152d224…	patch
https://github.com/craftcms/cms/commit/67780a778c…	patch
https://www.vulncheck.com/advisories/craft-cms-mu…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version	CPE status
craftcms	cms	Affected: 5.0.0-RC1 , < 5.9.0-beta.1 (semver) Unaffected: 5.9.0-beta.1 (semver) Affected: 4.0.0-RC1 , < 4.17.0-beta.1 (semver) Unaffected: 4.17.0-beta.1 (semver) cpe:2.3:a:juzaweb:cms:::::::: cpe:2.3:a:juzaweb:cms::::::::

Date Public

2026-03-02 00:00

Credits

mHe4am

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-56393",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-22T13:21:37.669665Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-22T13:22:05.584Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/craftcms/cms/security/advisories/GHSA-4mgv-366x-qxvx"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:composer/craftcms/cms",
          "product": "cms",
          "vendor": "craftcms",
          "versions": [
            {
              "lessThan": "5.9.0-beta.1",
              "status": "affected",
              "version": "5.0.0-RC1",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.9.0-beta.1",
              "versionType": "semver"
            },
            {
              "lessThan": "4.17.0-beta.1",
              "status": "affected",
              "version": "4.0.0-RC1",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "4.17.0-beta.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:juzaweb:cms:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.9.0-beta.1",
                  "versionStartIncluding": "5.0.0-RC1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:juzaweb:cms:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.17.0-beta.1",
                  "versionStartIncluding": "4.0.0-RC1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "mHe4am"
        }
      ],
      "datePublic": "2026-03-02T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Craft CMS 4.x (\u003e= 4.0.0-RC1, \u003c 4.17.0-beta.1) and 5.x (\u003e= 5.0.0-RC1, \u003c 5.9.0-beta.1) contain multiple stored cross-site scripting vulnerabilities where settings names and field option labels are rendered without sanitization (e.g., via the checkbox.twig template, which used {{ label|raw }}). An authenticated administrator (with allowAdminChanges enabled) can inject malicious payloads into section names, volume names, user group names, global set names, generated field names, checkbox/radio option labels, and custom source labels, causing arbitrary JavaScript to execute in other users\u0027 control-panel sessions. Fixed in 4.17.0-beta.1 and 5.9.0-beta.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 4.6,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "HIGH",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-21T13:27:01.755Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GHSA Advisory GHSA-4mgv-366x-qxvx",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/craftcms/cms/security/advisories/GHSA-4mgv-366x-qxvx"
        },
        {
          "name": "https://github.com/craftcms/cms/commit/943152d2246b36f12adf161a03b8695b773d9276",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/craftcms/cms/commit/943152d2246b36f12adf161a03b8695b773d9276"
        },
        {
          "name": "https://github.com/craftcms/cms/commit/67780a778c6ec04e68e64a0b1177c168306144a2",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/craftcms/cms/commit/67780a778c6ec04e68e64a0b1177c168306144a2"
        },
        {
          "name": "VulnCheck Advisory: Craft CMS - Multiple Stored Cross-Site Scripting in Settings Names and Field Options",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/craft-cms-multiple-stored-cross-site-scripting-in-settings-names-and-field-options"
        }
      ],
      "title": "Craft CMS - Multiple Stored Cross-Site Scripting in Settings Names and Field Options",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-56393",
    "datePublished": "2026-06-21T13:27:01.755Z",
    "dateReserved": "2026-06-21T12:37:58.434Z",
    "dateUpdated": "2026-06-22T13:22:05.584Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-56393",
      "date": "2026-09-16",
      "epss": "0.0032",
      "percentile": "0.24945"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-56393\",\"sourceIdentifier\":\"disclosure@vulncheck.com\",\"published\":\"2026-06-21T14:16:26.277\",\"lastModified\":\"2026-06-22T18:36:28.807\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Craft CMS 4.x (\u003e= 4.0.0-RC1, \u003c 4.17.0-beta.1) and 5.x (\u003e= 5.0.0-RC1, \u003c 5.9.0-beta.1) contain multiple stored cross-site scripting vulnerabilities where settings names and field option labels are rendered without sanitization (e.g., via the checkbox.twig template, which used {{ label|raw }}). An authenticated administrator (with allowAdminChanges enabled) can inject malicious payloads into section names, volume names, user group names, global set names, generated field names, checkbox/radio option labels, and custom source labels, causing arbitrary JavaScript to execute in other users\u0027 control-panel sessions. Fixed in 4.17.0-beta.1 and 5.9.0-beta.1.\"}],\"affected\":[{\"source\":\"disclosure@vulncheck.com\",\"affectedData\":[{\"vendor\":\"craftcms\",\"product\":\"cms\",\"defaultStatus\":\"unaffected\",\"packageURL\":\"pkg:composer/craftcms/cms\",\"versions\":[{\"version\":\"5.0.0-RC1\",\"lessThan\":\"5.9.0-beta.1\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.9.0-beta.1\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.0.0-RC1\",\"lessThan\":\"4.17.0-beta.1\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.17.0-beta.1\",\"versionType\":\"semver\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"disclosure@vulncheck.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":4.6,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"ACTIVE\",\"vulnConfidentialityImpact\":\"LOW\",\"vulnIntegrityImpact\":\"LOW\",\"vulnAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"LOW\",\"subIntegrityImpact\":\"LOW\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"cvssMetricV31\":[{\"source\":\"disclosure@vulncheck.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N\",\"baseScore\":4.8,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.7,\"impactScore\":2.7}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-06-22T13:21:37.669665Z\",\"id\":\"CVE-2026-56393\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"disclosure@vulncheck.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"references\":[{\"url\":\"https://github.com/craftcms/cms/commit/67780a778c6ec04e68e64a0b1177c168306144a2\",\"source\":\"disclosure@vulncheck.com\"},{\"url\":\"https://github.com/craftcms/cms/commit/943152d2246b36f12adf161a03b8695b773d9276\",\"source\":\"disclosure@vulncheck.com\"},{\"url\":\"https://github.com/craftcms/cms/security/advisories/GHSA-4mgv-366x-qxvx\",\"source\":\"disclosure@vulncheck.com\"},{\"url\":\"https://www.vulncheck.com/advisories/craft-cms-multiple-stored-cross-site-scripting-in-settings-names-and-field-options\",\"source\":\"disclosure@vulncheck.com\"},{\"url\":\"https://github.com/craftcms/cms/security/advisories/GHSA-4mgv-366x-qxvx\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-56393\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-22T13:21:37.669665Z\"}}}], \"references\": [{\"url\": \"https://github.com/craftcms/cms/security/advisories/GHSA-4mgv-366x-qxvx\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-22T13:22:00.581Z\"}}], \"cna\": {\"title\": \"Craft CMS - Multiple Stored Cross-Site Scripting in Settings Names and Field Options\", \"credits\": [{\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"mHe4am\"}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 4.6, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N\", \"exploitMaturity\": \"NOT_DEFINED\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"ACTIVE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"HIGH\", \"subIntegrityImpact\": \"LOW\", \"vulnIntegrityImpact\": \"LOW\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"LOW\", \"vulnConfidentialityImpact\": \"LOW\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 4.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"HIGH\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"vendor\": \"craftcms\", \"product\": \"cms\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.0.0-RC1\", \"lessThan\": \"5.9.0-beta.1\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.9.0-beta.1\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"4.0.0-RC1\", \"lessThan\": \"4.17.0-beta.1\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.17.0-beta.1\", \"versionType\": \"semver\"}], \"packageURL\": \"pkg:composer/craftcms/cms\", \"defaultStatus\": \"unaffected\"}], \"datePublic\": \"2026-03-02T00:00:00.000Z\", \"references\": [{\"url\": \"https://github.com/craftcms/cms/security/advisories/GHSA-4mgv-366x-qxvx\", \"name\": \"GHSA Advisory GHSA-4mgv-366x-qxvx\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"https://github.com/craftcms/cms/commit/943152d2246b36f12adf161a03b8695b773d9276\", \"name\": \"https://github.com/craftcms/cms/commit/943152d2246b36f12adf161a03b8695b773d9276\", \"tags\": [\"patch\"]}, {\"url\": \"https://github.com/craftcms/cms/commit/67780a778c6ec04e68e64a0b1177c168306144a2\", \"name\": \"https://github.com/craftcms/cms/commit/67780a778c6ec04e68e64a0b1177c168306144a2\", \"tags\": [\"patch\"]}, {\"url\": \"https://www.vulncheck.com/advisories/craft-cms-multiple-stored-cross-site-scripting-in-settings-names-and-field-options\", \"name\": \"VulnCheck Advisory: Craft CMS - Multiple Stored Cross-Site Scripting in Settings Names and Field Options\", \"tags\": [\"third-party-advisory\"]}], \"x_generator\": {\"engine\": \"vulncheck-endgame\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Craft CMS 4.x (\u003e= 4.0.0-RC1, \u003c 4.17.0-beta.1) and 5.x (\u003e= 5.0.0-RC1, \u003c 5.9.0-beta.1) contain multiple stored cross-site scripting vulnerabilities where settings names and field option labels are rendered without sanitization (e.g., via the checkbox.twig template, which used {{ label|raw }}). An authenticated administrator (with allowAdminChanges enabled) can inject malicious payloads into section names, volume names, user group names, global set names, generated field names, checkbox/radio option labels, and custom source labels, causing arbitrary JavaScript to execute in other users\u0027 control-panel sessions. Fixed in 4.17.0-beta.1 and 5.9.0-beta.1.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-79\", \"description\": \"Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)\"}]}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:juzaweb:cms:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.9.0-beta.1\", \"versionStartIncluding\": \"5.0.0-RC1\"}, {\"criteria\": \"cpe:2.3:a:juzaweb:cms:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.17.0-beta.1\", \"versionStartIncluding\": \"4.0.0-RC1\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"83251b91-4cc7-4094-a5c7-464a1b83ea10\", \"shortName\": \"VulnCheck\", \"dateUpdated\": \"2026-06-21T13:27:01.755Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-56393\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-06-22T13:22:05.584Z\", \"dateReserved\": \"2026-06-21T12:37:58.434Z\", \"assignerOrgId\": \"83251b91-4cc7-4094-a5c7-464a1b83ea10\", \"datePublished\": \"2026-06-21T13:27:01.755Z\", \"assignerShortName\": \"VulnCheck\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-56393

Vulnerability from fkie_nvd - Published: 2026-06-21 14:16 - Updated: 2026-06-22 18:36

Severity

4.8 (Medium) - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Summary

References

	URL	Tags
	disclosure@vulncheck.com	https://github.com/craftcms/cms/commit/67780a778c6ec04e68e64a0b1177c168306144a2
	disclosure@vulncheck.com	https://github.com/craftcms/cms/commit/943152d2246b36f12adf161a03b8695b773d9276
	disclosure@vulncheck.com	https://github.com/craftcms/cms/security/advisories/GHSA-4mgv-366x-qxvx
	disclosure@vulncheck.com	https://www.vulncheck.com/advisories/craft-cms-multiple-stored-cross-site-scripting-in-settings-names-and-field-options
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/craftcms/cms/security/advisories/GHSA-4mgv-366x-qxvx

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:composer/craftcms/cms",
          "product": "cms",
          "vendor": "craftcms",
          "versions": [
            {
              "lessThan": "5.9.0-beta.1",
              "status": "affected",
              "version": "5.0.0-RC1",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.9.0-beta.1",
              "versionType": "semver"
            },
            {
              "lessThan": "4.17.0-beta.1",
              "status": "affected",
              "version": "4.0.0-RC1",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "4.17.0-beta.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "disclosure@vulncheck.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Craft CMS 4.x (\u003e= 4.0.0-RC1, \u003c 4.17.0-beta.1) and 5.x (\u003e= 5.0.0-RC1, \u003c 5.9.0-beta.1) contain multiple stored cross-site scripting vulnerabilities where settings names and field option labels are rendered without sanitization (e.g., via the checkbox.twig template, which used {{ label|raw }}). An authenticated administrator (with allowAdminChanges enabled) can inject malicious payloads into section names, volume names, user group names, global set names, generated field names, checkbox/radio option labels, and custom source labels, causing arbitrary JavaScript to execute in other users\u0027 control-panel sessions. Fixed in 4.17.0-beta.1 and 5.9.0-beta.1."
    }
  ],
  "id": "CVE-2026-56393",
  "lastModified": "2026-06-22T18:36:28.807",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.8,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "HIGH",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.7,
        "impactScore": 2.7,
        "source": "disclosure@vulncheck.com",
        "type": "Secondary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 4.6,
          "baseSeverity": "MEDIUM",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "HIGH",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "LOW",
          "subIntegrityImpact": "LOW",
          "userInteraction": "ACTIVE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "LOW",
          "vulnIntegrityImpact": "LOW",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "disclosure@vulncheck.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-56393",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-06-22T13:21:37.669665Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-06-21T14:16:26.277",
  "references": [
    {
      "source": "disclosure@vulncheck.com",
      "url": "https://github.com/craftcms/cms/commit/67780a778c6ec04e68e64a0b1177c168306144a2"
    },
    {
      "source": "disclosure@vulncheck.com",
      "url": "https://github.com/craftcms/cms/commit/943152d2246b36f12adf161a03b8695b773d9276"
    },
    {
      "source": "disclosure@vulncheck.com",
      "url": "https://github.com/craftcms/cms/security/advisories/GHSA-4mgv-366x-qxvx"
    },
    {
      "source": "disclosure@vulncheck.com",
      "url": "https://www.vulncheck.com/advisories/craft-cms-multiple-stored-cross-site-scripting-in-settings-names-and-field-options"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/craftcms/cms/security/advisories/GHSA-4mgv-366x-qxvx"
    }
  ],
  "sourceIdentifier": "disclosure@vulncheck.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "disclosure@vulncheck.com",
      "type": "Secondary"
    }
  ]
}

GHSA-4MGV-366X-QXVX

Vulnerability from github – Published: 2026-03-03 20:58 – Updated: 2026-08-06 21:39

Summary

Craft CMS Vulnerable to Stored XSS in Settings Names and Field Options

Details

Overview of all XSS Reports

Multiple stored XSS vulnerabilities were found in Craft CMS. They were split into 4 reports as follows:

Report	What's Vulnerable	Why Separate
This Report (1)	Multiple settings names	Twig Template: `_includes/forms/checkbox.twig`
Report 2	Entry Types Name	Twig Template: `_includes/forms/editableTable.twig`
Report 3	Card Attributes in Field Layout	`helpers/Cp.php`
Report 4 (Commerce)	Product Type Name	Source in Commerce, sink in CMS - will report this one via Commerce GHSA

Reports 2, 3, and 4 are clearly distinct locations. For this report (Report 1), it was not clear whether to split or consolidate these 7 bugs. The bug report was consolidated and the final categorization should be left to the judgement of the user.

Note: This overview is only in this Report. Other reports only reference this one.

Summary

Stored XSS in multiple settings. Names/labels are rendered without sanitization via checkbox.twig template which uses {{ label|raw }}.

Affected Sources

#	Source (injection point)	Sink (where payload reflects)
1	Section Name (`/admin/settings/sections`)	Entries field -> Sources checklist
2	Volume Name (`/admin/settings/assets/volumes/{vol_id}`)	Assets field -> Sources checklist
3	User Group Name (`/admin/settings/users/groups`)	Users field -> Sources, User permissions page
4	Global Set Name (`/admin/settings/globals`)	User permissions page
5	Generated Fields Name (Volumes, Users, etc.)	Card Attributes checkboxes
6	Checkboxes & Radio Buttons Field Option Label (`/admin/settings/fields`)	User profile pages
7	Custom Sources Label (`/admin/users` -> Customize Sources)	Users field -> Sources checklist

Proof of Concept

Required Permissions (Attacker)

Admin access
allowAdminChanges is enabled in production, which is against our security recommendations.

Bugs 1-3: Section, Volume, User Group Names

Log in as admin.
Inject payload in one of these:
Settings -> Sections -> Create/edit section -> Name
Settings -> Assets -> Volumes -> Create/edit volume -> Name
Settings -> Users -> User Groups -> Create/edit group -> Name
Set Name to:

<img src=x onerror="alert('XSS')">

Save.
Go to Settings -> Fields -> Create new field.
To trigger the XSS payload: Set Field Type to "Entries" (for Sections), "Assets" (for Volumes), or "Users" (for User Groups). The alert fires when the Sources checkbox list renders.

Note: User Group Name also reflects on User permissions page under User Groups section (/admin/users/{id}/permissions).

Bug 4: Global Set Name

Go to Settings -> Globals (/admin/settings/globals).
Create/edit a Global Set, set Name to payload.
Save.
Go to Users -> Edit any user -> Permissions tab (/admin/users/{id}/permissions).
Alert fires because our payload got rendered in the "Global Sets" permissions section without encoding/sanitization.

Bug 5: Generated Fields Name

Go to Settings -> Assets -> Volumes -> Create/Edit a volume.
Scroll to Generated Fields section.
Add a field, set Name to payload:

<img src=x onerror="alert('XSS')">

Save & Notice the alert. The payload renders in the Card Attributes checkbox list below it.

Bug 6: Checkboxes/Radio Buttons Option Label

Go to Settings -> Fields (/admin/settings/fields).
Create new field, set Field Type to "Checkboxes" or "Radio Buttons".
In Field Options, add an option with Label set to payload.
Save the field.
Go to Settings -> Users -> User Profile Fields (/admin/settings/users/fields).
Add the created field to the layout and save.
Alert fires on any user profile page (/admin/users/{id}).

Bug 7: Custom Sources Label

Go to Users (/admin/users).
Click the three dots icon -> Customize Sources.
Create a new custom source, set Label to payload.
Save.
Go to Settings -> Fields -> Create new field.
Set Field Type to "Users".
Alert fires in the Sources checkbox list.

Resources

https://github.com/craftcms/cms/commit/943152d2246b36f12adf161a03b8695b773d9276 https://github.com/craftcms/cms/commit/67780a778c6ec04e68e64a0b1177c168306144a2

Severity

2.1 (Low)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "craftcms/cms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0.0-RC1"
            },
            {
              "fixed": "5.9.0-beta.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "craftcms/cms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0-RC1"
            },
            {
              "fixed": "4.17.0-beta.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-56393"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-03T20:58:07Z",
    "nvd_published_at": null,
    "severity": "LOW"
  },
  "details": "## Overview of all XSS Reports\n\nMultiple stored XSS vulnerabilities were found in Craft CMS. They were split into **4 reports** as follows:\n\n| Report | What\u0027s Vulnerable | Why Separate |\n|--------|-------------------|--------------|\n| **This Report (1)** | Multiple settings names | Twig Template: `_includes/forms/checkbox.twig` |\n| **Report 2** | Entry Types Name | Twig Template: `_includes/forms/editableTable.twig` |\n| **Report 3** | Card Attributes in Field Layout | `helpers/Cp.php` |\n| **Report 4 (Commerce)** | Product Type Name | Source in Commerce, sink in CMS - will report this one via Commerce GHSA |\n\nReports 2, 3, and 4 are clearly distinct locations. For this report (Report 1), it was not clear whether to split or consolidate these 7 bugs. The bug report was consolidated and the final categorization should be left to the judgement of the user.\n\n**Note:** This overview is only in this Report. Other reports only reference this one.\n\n---\n## Summary\n\nStored XSS in multiple settings. Names/labels are rendered without sanitization via `checkbox.twig` template which uses `{{ label|raw }}`.\n\n---\n## Affected Sources\n\n| #   | Source (injection point)                                                 | Sink (where payload reflects)                 |\n| --- | ------------------------------------------------------------------------ | --------------------------------------------- |\n| 1   | Section Name (`/admin/settings/sections`)                                | Entries field -\u003e Sources checklist            |\n| 2   | Volume Name (`/admin/settings/assets/volumes/{vol_id}`)                  | Assets field -\u003e Sources checklist             |\n| 3   | User Group Name (`/admin/settings/users/groups`)                         | Users field -\u003e Sources, User permissions page |\n| 4   | Global Set Name (`/admin/settings/globals`)                              | User permissions page                         |\n| 5   | Generated Fields Name (Volumes, Users, etc.)                             | Card Attributes checkboxes                    |\n| 6   | Checkboxes \u0026 Radio Buttons Field Option Label (`/admin/settings/fields`) | User profile pages                            |\n| 7   | Custom Sources Label (`/admin/users` -\u003e Customize Sources)               | Users field -\u003e Sources checklist              |\n\n---\n## Proof of Concept\n\n### Required Permissions (Attacker)\n- Admin access\n- `allowAdminChanges` is enabled in production, which is against our [security recommendations](https://craftcms.com/knowledge-base/securing-craft).\n\n### Bugs 1-3: Section, Volume, User Group Names\n\n1. Log in as admin.\n2. Inject payload in one of these:\n   - **Settings** -\u003e **Sections** -\u003e Create/edit section -\u003e **Name**\n   - **Settings** -\u003e **Assets** -\u003e **Volumes** -\u003e Create/edit volume -\u003e **Name**\n   - **Settings** -\u003e **Users** -\u003e **User Groups** -\u003e Create/edit group -\u003e **Name**\n3. Set **Name** to:\n```html\n\u003cimg src=x onerror=\"alert(\u0027XSS\u0027)\"\u003e\n```\n4. Save.\n5. Go to **Settings** -\u003e **Fields** -\u003e Create new field.\n6. To trigger the XSS payload: Set **Field Type** to \"Entries\" (for Sections), \"Assets\" (for Volumes), or \"Users\" (for User Groups). The alert fires when the Sources checkbox list renders.\n\n**Note:** User Group Name also reflects on **User permissions page** under **User Groups** section (`/admin/users/{id}/permissions`).\n\n---\n\n### Bug 4: Global Set Name\n\n1. Go to **Settings** -\u003e **Globals** (`/admin/settings/globals`).\n2. Create/edit a Global Set, set **Name** to payload.\n3. Save.\n4. Go to **Users** -\u003e Edit any user -\u003e **Permissions** tab (`/admin/users/{id}/permissions`).\n5. Alert fires because our payload got rendered in the \"Global Sets\" permissions section without encoding/sanitization.\n\n---\n\n### Bug 5: Generated Fields Name\n\n1. Go to **Settings** -\u003e **Assets** -\u003e **Volumes** -\u003e Create/Edit a volume.\n2. Scroll to **Generated Fields** section.\n3. Add a field, set **Name** to payload:\n```html\n\u003cimg src=x onerror=\"alert(\u0027XSS\u0027)\"\u003e\n```\n4. Save \u0026 Notice the alert. The payload renders in the **Card Attributes** checkbox list below it.\n\n---\n\n### Bug 6: Checkboxes/Radio Buttons Option Label\n\n1. Go to **Settings** -\u003e **Fields** (`/admin/settings/fields`).\n2. Create new field, set **Field Type** to \"Checkboxes\" or \"Radio Buttons\".\n3. In **Field Options**, add an option with **Label** set to payload.\n4. Save the field.\n5. Go to **Settings** -\u003e **Users** -\u003e **User Profile Fields** (`/admin/settings/users/fields`).\n6. Add the created field to the layout and save.\n7. Alert fires on any user profile page (`/admin/users/{id}`).\n\n---\n\n### Bug 7: Custom Sources Label\n\n1. Go to **Users** (`/admin/users`).\n2. Click the three dots icon -\u003e **Customize Sources**.\n3. Create a new custom source, set **Label** to payload.\n4. Save.\n5. Go to **Settings** -\u003e **Fields** -\u003e Create new field.\n6. Set **Field Type** to \"Users\".\n7. Alert fires in the Sources checkbox list.\n\n## Resources\n\nhttps://github.com/craftcms/cms/commit/943152d2246b36f12adf161a03b8695b773d9276\nhttps://github.com/craftcms/cms/commit/67780a778c6ec04e68e64a0b1177c168306144a2",
  "id": "GHSA-4mgv-366x-qxvx",
  "modified": "2026-08-06T21:39:51Z",
  "published": "2026-03-03T20:58:07Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/craftcms/cms/security/advisories/GHSA-4mgv-366x-qxvx"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56393"
    },
    {
      "type": "WEB",
      "url": "https://github.com/craftcms/cms/commit/67780a778c6ec04e68e64a0b1177c168306144a2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/craftcms/cms/commit/943152d2246b36f12adf161a03b8695b773d9276"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/craftcms/cms"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/craft-cms-multiple-stored-cross-site-scripting-in-settings-names-and-field-options"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Craft CMS Vulnerable to Stored XSS in Settings Names and Field Options"
}

GHSA-F95G-VM94-46C3

Vulnerability from github – Published: 2026-06-21 15:31 – Updated: 2026-08-06 21:39

Withdrawn 2026-08-06

Summary

Duplicate Advisory: Craft CMS Vulnerable to Stored XSS in Settings Names and Field Options

Details

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-4mgv-366x-qxvx. This link is maintained to preserve external references.

Original Description

Severity

4.8 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

4.6 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c 5.9.0-beta.1"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "craftcms/cms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0.0-RC1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-06T21:39:45Z",
    "nvd_published_at": "2026-06-21T14:16:26Z",
    "severity": "MODERATE"
  },
  "details": "## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-4mgv-366x-qxvx. This link is maintained to preserve external references.\n\n## Original Description\nCraft CMS 4.x (\u003e= 4.0.0-RC1, \u003c 4.17.0-beta.1) and 5.x (\u003e= 5.0.0-RC1, \u003c 5.9.0-beta.1) contain multiple stored cross-site scripting vulnerabilities where settings names and field option labels are rendered without sanitization (e.g., via the checkbox.twig template, which used {{ label|raw }}). An authenticated administrator (with allowAdminChanges enabled) can inject malicious payloads into section names, volume names, user group names, global set names, generated field names, checkbox/radio option labels, and custom source labels, causing arbitrary JavaScript to execute in other users\u0027 control-panel sessions. Fixed in 4.17.0-beta.1 and 5.9.0-beta.1.",
  "id": "GHSA-f95g-vm94-46c3",
  "modified": "2026-08-06T21:39:45Z",
  "published": "2026-06-21T15:31:25Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/craftcms/cms/security/advisories/GHSA-4mgv-366x-qxvx"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56393"
    },
    {
      "type": "WEB",
      "url": "https://github.com/craftcms/cms/commit/67780a778c6ec04e68e64a0b1177c168306144a2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/craftcms/cms/commit/943152d2246b36f12adf161a03b8695b773d9276"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/craft-cms-multiple-stored-cross-site-scripting-in-settings-names-and-field-options"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Duplicate Advisory: Craft CMS Vulnerable to Stored XSS in Settings Names and Field Options",
  "withdrawn": "2026-08-06T21:39:45Z"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-56393 (GCVE-0-2026-56393)

FKIE_CVE-2026-56393

GHSA-4MGV-366X-QXVX

Overview of all XSS Reports

Summary

Affected Sources

Proof of Concept

Required Permissions (Attacker)

Bugs 1-3: Section, Volume, User Group Names

Bug 4: Global Set Name

Bug 5: Generated Fields Name

Bug 6: Checkboxes/Radio Buttons Option Label

Bug 7: Custom Sources Label

Resources

GHSA-F95G-VM94-46C3

Duplicate Advisory

Original Description

Tags

Sightings

Nomenclature

Related by attack behaviour